Afiafi 
CISCO 


January 19, 2022 


To: Human Rights Watch, Children’s Rights Division 


Thank you for contacting Cisco. We appreciate the opportunity to provide input to this 
important research. In our effort to provide a comprehensive response to Human Rights Watch, 
please find our information organized into the following sections: 


e Executive Summary 
e Question and Answer Detailed Summary 
e Additional Resources 


We welcome any requests for additional information as well as recommendations you may 
have for Cisco. 


Executive Summary 


Cisco has long recognized corporate responsibility to respect human rights, and our Human 
Rights Policy formalizes our commitment to uphold and respect these rights. We are committed 
to the UN Guiding Principles on Business and Human Rights and uphold and respect all 
internationally recognized human rights as contained in the Universal Declaration of Human 
Rights (UDHR), the International Covenant on Civil and Political Rights (ICCPR), the International 
Covenant on Economic, Social, and Cultural Rights (ICESCR), and the eight core International 
Labour Organization (ILO) conventions. Moreover, with respect to our education offerings and 
otherwise, Cisco is committed to respecting children's rights, as outlined in our Global Human 
Rights Policy. 


Cisco believes privacy is a fundamental human right, and our products, including Webex by 
Cisco (“Webex”), are designed with privacy and security front of mind. Cisco strives to be best 
in class with regards to transparency; as part of that, we disclose our policies and practices 
around privacy and data security, including what customer data we collect and process, why we 
process such data, and what we do not do with that data. In the Additional Resources section, 
please find several items that address privacy for the use of Webex in educational settings. 


Cisco has provided detailed responses to your questions in the sections that follow. In brief: 
e Cisco is committed to transparency, our users’ right to privacy, and to children’s rights. 


e Cisco data practices are publicly available and designed with accessibility and clarity in 
mind. 
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e Cisco does not use or sell data collected through Webex for advertising, behavioral 
advertising, or any other similar purpose. 

e Cisco does not use Webex user data for profiling purposes and we do not share user 
data with third-party advertising technology companies. 


We hope that our responses help clarify your findings with regard to data processing within the 
Webex apps and further illustrate Cisco’s deep respect for children’s rights. 


Question and Answer Detailed Summary 
Human Rights Watch Inquiry: 


1. Human Rights Watch detected Cisco Webex’s app collecting users’ Android 
Advertising ID and International Mobile Equipment Identity (IMEI) numbers, and 
engaging in ID bridging between the two; collecting users’ precise location data, 
time of current location, last known location, coarse location, and WiFi SSID; 
collecting information about users’ contacts, including any profile photos; collecting 
users’ phone numbers and call logs; accessing users’ cameras and microphones, and 
having 3 embedded SDKs. Can you confirm this? 

a. If our observations are accurate, can you please explain if, and why, you 

consider these data practices to be proportionate and necessary for 

children’s education? 

a. Does Cisco fully disclose these data practices to its users in clear, 

accessible language? 


Cisco’s response: 


Our response addresses the following Webex services: Webex Meetings, Webex Messaging, 
Webex Events, Webex Training, and Webex Calling. Cisco’s Privacy Data Sheets for those 
services are available through Cisco’s Trust Portal and disclose Cisco’s data practices in clear 
and accessible language. In addition to these existing resources, we performed a deep-dive 
analysis to address the specific elements raised by Human Rights Watch. Based on our current 
understanding of the elements and terms in your letter and our current operation of Webex, 
we can confirm the following: 
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Webex does not: 


Collect Android Advertising ID; 
Collect International Mobile Equipment Identity (IMEI) numbers; 
Engage in “bridging ID” between Android Advertising ID and IMEI number; 


Collect users’ precise location, last known location, or coarse location; ! 
Collect users’ call logs. 


Webex does: 


Collect information about the users’ contacts, if permission is granted by the user, 
including profile photos of those contacts, to provide a better user experience; 

Collect users’ phone numbers, when a user utilizes Webex Calling within the App, which 
is necessary to establish communication and provide the service; 

Access users’ cameras and microphones to provide picture and audio during a Webex 
Meeting or call, or to discover and pair Webex Video & Conference Room devices based 
on an ultrasound pairing code, but only if permission is granted by the user. Users can 
withdraw their permission and disable these features at any time; 

Collect the time at the user’s current location, from the clock on the user’s device, to 
provide the service; 

Collect WiFi SSID, for the purpose of provisioning emergency call (E911) services when a 
user utilizes Webex Calling;? 

Include a subset of the following SDKs, depending on the operating system a user is using 
to access Webex: Backtrace, Firebase, Amplitude, AppDynamics, and CloudCherry. These 
SDKs are utilized to provide and improve upon the service, for example to quantify user 
metrics. Those SDKs are not used for advertising or marketing. 


In sum, the data elements raised by Human Rights Watch that Cisco collects from users are 
necessary for provisioning of certain Webex services and such collection is optional to the user 
or is only activated by specific circumstances. All specified functions are necessary to provide 
various Webex services (Webex Calling, Webex Meetings, Webex Events, Webex Training, and 
Webex Messaging), including the optional features that users may elect to use. For more 
information about the scope of those services, you can also reference the product-specific 
terms found in our Webex Offer Descriptions, linked here. 


* While Webex does not generally collect precise location, there is an optional “driving mode” feature on Webex 
applications operating on an Android device that, if enabled, will collect user’s precise location to detect if 
someone is driving and put the application into driving mode. 

? To be clear, neither Webex Meetings nor Webex Messaging—what we believe most educators use over the 
Webex Calling functionality—collect precise user location and other location-related elements described above. 
“Geolocation,” as noted in the relevant Webex Privacy Data Sheets, refers to a country code based on IP address; it 
does not refer to a precise user location, for example coordinates or address. 
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Human Rights Watch Inquiry: 


2. Are any children’s data collected by Cisco Webex used for advertising, behavioral 
advertising, or other commercial purposes? 


Cisco’s response: 


No. Cisco does not use any children’s data collected through Webex for advertising, behavioral 
advertising, or any other similar purpose. Cisco may directly market Cisco products and/or 
services to Webex users, but users must opt into those types of marketing communications. To 
learn more about the limited purposes for which Cisco does use the information collected via 
Webex, see Cisco's Privacy Data Sheets, linked below in Additional Resources. 


Human Rights Watch Inquiry: 


3. Does Cisco engage in user profiling? If so, does Cisco Webex collect or receive 
additional data about its users from other sources that it adds to the profiles it holds 
on its users? 


Cisco’s response: 


Cisco does not use Webex user data for profiling purposes.? 


3 Some versions of Webex may include a feature called People Insights, which allows users to enrich their profiles 
within Webex with public data via a targeted data discovery process. However, People Insights is not activated for 
educational organizations, and it is not included in the version of Webex that was rolled out to educational 
organizations. Additionally, any customer—education organization or otherwise—can request that People Insights 
be disabled for their organization at any time. 
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Human Rights Watch Inquiry: 


4. Does Cisco share children’s data with third party advertising technology 
companies or other parties? If so: 
a. Who are they? 
b. Have you placed contractual obligations or stipulations on these third 
parties regarding how they may use the data they receive from you, and with 
whom they may further share this data? If so, how do you monitor 
compliance? 
c. Have you notified the third party that they are receiving children’s data? 


Cisco’s response: 


Cisco does not share user data, including minor’s user data, with third-party advertising 
technology companies or to other third parties for advertising purposes. Cisco does rely on 
certain third-party sub-processors to provide the Webex Meetings and Webex App services; 
those sub-processors are listed in Cisco’s Data Privacy Sheets (available on the Trust Portal) 
used exclusively for the provisioning and improvement of our services. Those sub-processors 
are notified that they are receiving customer personal data, which includes data belonging to 
minors. Furthermore, sub-processors are subject to data processing agreements (DPAs) that, 
among other things, include specific restrictions on the purposes for which our sub-processors 
may use, as well as measures that must be implemented to safeguard, such data. 


Additionally, users can elect to integrate various third-party services with Webex, to enhance 
their user experience. A user or user administrator controls the integration of those third-party 
services, and their use of such integrations is subject to separate terms between the user 
and/or the user’s organization and the relevant third party. 


In closing, Cisco is committed to our users’ privacy and to transparency, and we welcome any 
recommendations you identify through this research. 
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Additional Resources 
We invite you to review the resources below for further information: 


Webex Meetings Privacy Data Sheet 

Webex Messaging Privacy Data Sheet 

Webex Calling Privacy Data Sheet 

Webex Security & Privacy for Education White Paper 

Cisco Collaboration for Education — Administrator Privacy and Security FAQ 

Cisco Collaboration for Education — Parent and Guardian Privacy and Security FAQ 
Webex Security Advantage White Paper 

News Release: Cisco Establishes Industry Trust Benchmark for Digital Transformation 
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